Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

Exstatica writes "It looks like TimeWarner is taking vigilante action on the botnet problem. They've hijacked DNS for a few IRC servers, the latest being irc.mzima.net and irc.nac.net — both part of EFNet. (irc.vel.net was hijacked earlier but has been restored.) Using ns1.sd.cox.net, the lookup returns an IP for what looks to be a script that forces the user into a channel and issues a set of commands to clean the drones. There have been different reports of other IRC networks being hijacked and other DNS servers involved. Is this the right way to handle the botnet problem? Is hijacking DNS legal?" Botnets are starting to move off of IRC for command and control, anyway. Update: 07/24 00:01 GMT by KD: Updated and added more links; thanks to Drew Matthews at vel.net. 07/24 11:52 GMT by KD: Daniel Haskell wrote in to say that ircd.nac.net is seeing cox.net connections again, and that they are in discussion with the EFF over the matter.

Since submitting this article yesterday there have been some new developments.
There was a large debate on Nanog about what has been happening and eventually was published to wired [wired.com].
The full description of everything that has happened and how it happened can be found on my site at http://www.exstatica.net/hijacked/ [exstatica.net] as for irc.vel.net we have been returned our dns, but irc.mzima.net appears to still be hijacked.

This is in no way a new practice -- Time Warner has been doing this for well over two years. In the past script kiddies who have been caught hosting botnet servers on *.res.rr.com machines had their DNS's redirected to a single server in which all registered IRC users would be directed to #badbotbad, with the topic as.remove. It did, and still does, little to stop the botnet problem since the methods TW uses to sniff out the botnet servers are very specific to IRC protocol. That, and the server would only remove a standard kiddie rxbot with unchanged commands. --Manix

Next you'll argue that reverse engineering a virus is a violation of the DMCA.

Bit exaggerated use of a slippery slope metaphor. IANAL but to my understanding, their actions were closer to breaking into somebody's house to steal back your remote control. Not to justify their actions- just clarifying.

Ill be the first to say it. Who the fuck cares. The problem is being delt with.

I'll be the first to ask: If you don't give a hoot about this issue, what are you doing in this topic, let alone in the/. community?

Realistically anyone attempting to prosecute Cox for exploiting a backdoor in a botnet is going to have a hard time keeping their client out of jail.

I look forward to Cox meeting their lawyers.Evil_lawyer_dude: You have exploited a vulnerability in my clients softwareCox Communications: Ooops, so we have, would you care to name your clientEvil_lawter_dude: I don't have toCox Communications: Well, without evidence of harm done to your client we can't be held liable for anythingEvil_lawyer_dude: My client has been unable to carry on his business using the resources of your customersCox Communications: Yes, and we have a list of customers who would be part of a counter suit, no go away or we will taunt you some more.

The answer is, both are doing it. Apparently, there are different techniques - one lot is using forged DNS responses to redirect connections to their own server, and the other is intercepting packets to port 6667 on certain IP addresses and sending them to their own server.

I'm part of an organization that works on disabling botnets together with other people from various irc networks. I do not understand why timewarner did not even bother try to contact us - even though I had contact to their abuse desk long time ago.

Perhaps they're simply unaware that you exist? I'm sure the people staffing abuse@ are a bit separated from the people making these types of decisions.

Since it sounds like they were doing it with their DNS servers. While it would be illegal for me to break in to your DNS server and modify it, it is not illegal for me to modify my DNS server, even if you use it. If you dislike it, you can use another service, but unless I have a contract with you there's nothing wrong with it (legally). You can argue it is a bad idea, but changing their equipment on their network is well within their rights.

I thought OpenDNS was the greatest thing, until I noticed if you type in a URL that isn't valid it doesn't deliver the standard "non-existent domain" return, but instead gives you an OpenDNS search results page. Bleh. I'll stick with running Bind on my own server, thank you.

I thought OpenDNS was the greatest thing, until I noticed if you type in a URL that isn't valid it doesn't deliver the standard "non-existent domain" return, but instead gives you an OpenDNS search results page. Bleh. I'll stick with running Bind on my own server, thank you.

Actually, if you signup for a free account, and add your IP(s) in their dashboard webapp, you can configure all sorts of things, including to return NXDOMAIN on resolution failure.

I too agree that breaking NXDOMAIN is a bad thing, but OpenDNS at least does let you change this yourself. It just has the wrong default, so to speak.

I strongly urge you to signup for a free account, and look over their settings available, before you judge.

The law doesn't seem to agree with you. From the thing you didn't read: (b) Diversion of services.--A person is guilty of theft if, having control over the disposition of services of others to which he is not entitled, he knowingly diverts such services to his own benefit or to the benefit of another not entitled thereto. Whether that benefit is monetary doesn't seem to matter.It turns out that when you're a telecommunications provider, there are a whole bunch of laws to the effect of "you can't divert or

A DNS response to a widespread bot infection, a worm attack, or other overwhelming threat would be to claim SOA for the offending domain on your network, and resolve the entire domain to 127.0.0.1. Even that's sketchy, but it's what we might call the internet equivalent of Generally Accepted Accounting Principles. I've seen registrars themselves nullroute a domain and in general ther

A DNS response to a widespread bot infection, a worm attack, or other overwhelming threat would be to claim SOA for the offending domain on your network, and resolve the entire domain to 127.0.0.1. Even that's sketchy

Indeed. It goes even farther -- I don't particularly like efnet, but I do imagine there are still legitimate chat and discussions going on between real human beings. So resolving it to localhost means legitimate connections that have nothing to do with the botnet are dropped in order to stop t

Politicians are more concerned with pampering the amok-running entertainment industry, providers are more concerned with keeping their pink contract customers, users are more concerned with getting cheap viagra and don't care about the number of botnets their computers are part of and law enforcement is chasing whoever is tagged with the kiddieporn or terrorism flag.

If admins don't take it into their own hands, nobody is going to do anything.

The problem is Windows, but you would like to blame and punish IRC servers and users. Why?

No, that's just typical Twitter bullshit. The problem is moronic users who don't do enough to protect themselves from viruses, spyware, trojans, and worms. Linux is just as vulnerable in the hands of a complete idiot (well, if they can even get it installed, anyway).

If Time Warner was really concerned about it wouldnt it be easier and more effective to use their virtual truck (TW Self help) application to redirect the users browser start page to a list of instructions, tools and a support number to clean up their system? I have seen several instances were they redirect users to a "disabled due to non-payment" type pages...would a "Hey idiot your computer is infected" page be that difficult?

A while back, I got a "your computer is infected" notice from them. I checked all my computers, the Windows ones with tools that weren't even available to the public at the time, and zero, zip, nada. Everything was clean, sniffs showed nothing out of place.

Finally talked with someone with a clue, and they classified my SpamAssassin install as a DOS on their name servers because they were caching the negative responses from the various blacklists.

You mean you actually talked to someone in tech support who not only knew what a packet was but also looked up what was happening on their end at a technical level? How many drones did you have to speak to telling you to A)reboot or B)reinstall your machine? Did you use chicken blood or ox blood to perform this magic?

Actually, if you can get past the first level of drones (and sometimes the second level, depending on the company), you'll talk to people who know not only what a packet is, but also can do actual troubleshooting on the modem connection and make some sense of it. I've experienced this with Comcast, Adelphia, and Time-Warner (it was completely absent, so far as I could tell, from MediaOne when they were around); in one case, I got a very thorough explanation of the problem as it related to head-end equipment and what needed to be done to fix it from the tech as she was entering it into the work order.

The problem, of course, is that almost all users that call in don't need more than scripted hand-holding, and those of us that know what we're talking about call in and hit that wall, through which it can be very difficult to find an open window through which to crawl to find a knowledgeable person.

Remember, the job of a TSR and CSR is among the jobs with the highest turn-over rate.

The people that apply (and get) these jobs fall in two main categories. The first being entry level. The second being highly skilled IT professionals who got laid off and need something to pay the bills until the find a better job. As such, you will get a nice mix of idiots and very brilliant staff manning the phone queue.

I tend to ask my Tech Support guy a few questions before requiring assistance to help prevent this. I shall now add "What is a packet?" to my list.;)
If they fail the questions, I ask to be passed to someone else.

Frankly, I think it's about time somebody started ACTING on the problems we face online. Botnets are a huge global issue, and we simply must do all that we can to stop them.
Although I suppose this probably could be considered illegal (remotely installing software on somebody's PC without their authorisation breaks pretty much every anti-hacking law in the land), how else can we tackle these issues?
Zombie PCs aren't going away any time soon, so more needs to be done.
The only problem is as the OP origin

I think this action is right-on. The parts of the equation missing are trust and accountability.

We don't trust vigilantes, not because we don't agree with them, but because we don't trust them to always act in the greater good. Their future actions and motivations are unknowns. Since their identities may even be secret, there's no way to hold them accountable.

Why are we ok with the police taking the same actions as a vigilante would take? Because of trust earned through accountability. To retask a familiar saying: "Put all your eggs in one basket and then watch that basket". That basket is the police, and we've put all our eggs in it. That means the public at large can watch the police, who are well-known and generally easy to spot. It means that internal controls can be set up, and rules of engagement can be put in place. We trust the police as much as we do because we know that, ultimately, they're under the control of the general public, who can exert pressure on them when they act badly. This is why we tend to put more trust in organizations, rather than individuals. Organizations are easier to censure.

Understanding that, it's easy to see what the course of action needs to be. As much as we here at/. tend to have a love/hate relationship with authorities, I think one needs to be set up specifically to deal with these problems. They need to be given what power is necessary to deal with the problems like spam, trojans, botnets, whatever, but at the same time, they need to be directly accountable to the public in a similar manner to police forces. Legitimize the vigilante action by coupling it with accountability.

I don't really know the specifics of setting up something like this, but I think using the police as a model would be the way to go. Rules and procedures, all the requisite bureaucracy, but also the ability to launch tactical "busts", "cyber" or otherwise. They'd need all the same approvals, warrants, etc. They'd have branches in all concerned countries, and would work through the legal systems in their home countries. In some countries, they might be a part of the police force, since much of the administrivia would be similar. Ultimately, I'd think CERT or something like it would be a good headquarters or parent organization for such a group.

The point is that we've already worked this out in the "Real World". Applying it to The Internet shouldn't be a patent-worthy exercise. While I wish we didn't need government involvement, much of the authority required is the type of authority that only government can legitimately grant, such as the ability to seize equipment.

I aplogize that this isn't as eloquently described as I'd have liked, but I think the general idea is there. You may now procede to flame me for advocating the Policing of the Intertubes but ultimately, I think that's where we're headed.

So there's a temporary interruption to what, 2 irc servers? Out of thousands?Oh, the humanity!!!Pick another damn server to get your chat on. It's not like they're blocking port 80. I'd bet only a tiny percentage of users even still use IRC, and out of those only a few even use the servers affected.

OK, it's nice that you know what EF stands for in EFnet, but what you may have missed is that when the IRC network (it didn't have a name back then -- it was just `IRC') split, it split into AnarchyNet (or just Anet) and Efnet. There was no need for names before that, but after that, those are the names that were chosen.

Anet was the one where `anything goes', and yes, it did have a server called eris. The big thing that went on Anet that didn't go on Efnet was that new servers didn't need a password

Let's face it, the company with the most responsibility in the Botnet mess, Microsoft, has been sitting on their hands when it comes to dealing with the issue. Well, until they figured out they could make a buck at it.

Botnets are used by organized crime for spam, stock scams and a host of other illegal activities. It's time someone did something...if only for the political effect.

No. The right way involves castration with rusty linoleum knives, Turkish prisons, and rabid wolverines. If that doesn't work, we should quit being nice and get nasty with these folks. Seriously, this problem will not go away until people start doing some hard time, preferably with a cell mate who does not need Erct|le Member Help!

Frankly, redirecting requests to malware sites, or IRC communication channels, to cleaner-sites sounds like a practical short term tactic to me. And if it raises awareness around the seriousness of the bot problem I'm all for it.

Right, because the kind of people who might actually use IRC know nothing about botnets and the kind of Windoze users who are part of the botnet care about IRC. This is just another attack on the free software community as outlined in the Haloween Documents.

Once again, the ISP has punished the good guys for problems crated by the bad guys. The root cause of the botnet is Windoze. Fixing it and raising awareness is as simple as cutting the problem computers off your network and telling their owners why. This is as it should be and pretending otherwise props up third rate software and threatens the stability of the net.

Once again, the ISP has punished the good guys for problems crated by the bad guys. The root cause of the botnet is Windoze. Fixing it and raising awareness is as simple as cutting the problem computers off your network and telling their owners why. This is as it should be and pretending otherwise props up third rate software and threatens the stability of the net.

I wish I hadn't run out of mod points; this is gold.

That's a pretty cut and dried way of reducing the number of bots. Cutting the user off forces them to understand what is wrong and why they're cut off. If you just give them information most will just click past it and continue on their merry way. Users don't want information. They want the pr0nz as quick as possible. Didn't you know that?

I can think of one case where a (now ex) friend of mine would email To: every single person in her work address book with SPAM for her work. I started out telling her to use the Bcc: field at least and pointed her to a web page describing why you'd want to do that. she replied "I don't want to read all that technical garbage" then carried on the same. Then I asked her to remove me from her list. She replied "I am going to send you this stuff because I know you want it" (it really was SPAM for her work, it wasn't even jokes or chain mail). There ended our friendship as I reported them to their ISP. They were warned by their ISP and still continued doing what they did. They lost hosting pretty quick after that.

People don't want to learn. They are, by and large, idiots. Heavy handed measures are the only way to force them to realise that fact.

Other than that aimed at users being responsible for their own computers. The botnet's root cause is not "Windoze", it's the people who are ignorant or lazy enough to let their computers be taken over by trojans and worms. Since it's stupidly simple to avoid that, the problem lies squarely between keyboard and chair.

I expect that the same people who neglect their PCs by downloading and opening random crap and not even bothering to leave automatic updates running will be as detrimental to OS X or Linux if

The botnet's root cause is not "Windoze", it's the people who are ignorant or lazy enough to let their computers be taken over by trojans and worms. Since it's stupidly simple to avoid that, the problem lies squarely between keyboard and chair.

Both ignorance and apathy would be cured by kicking off infected computers. I'd be looking forward to "responsible user" dedazo being kicked off but I think the PR firm he works for uses a botnet to post all it's

Both ignorance and apathy would be cured by kicking off infected computers

Well, yes. That's one solution I guess.

I'd be looking forward to "responsible user" dedazo being kicked off

Unfortunately for you, none of my "M$ Windoze" machines are in any botnets, have any malware or are otherwise compromised, much like many other hundreds of millions of other PCs running "Windoze" out there.

I think the PR firm he works for uses a botnet to post all it's pro M$ blather

Well, look: it almost certainly is their fault that they got infected. You don't have to be a super genius to avoid getting infected, you just need enough self-control to not install every search toolbar or smiley-face cursors package that comes along.

That doesn't mean the OS is blameless, though - it can and should be more difficult for idiots to get themselves infected. But educating the users would be more effective. If they all switched to Linux, they'd just start clicking stuff like "Get 1000 free KDE

Problem is that you can't convict anybody of anything when the Internet is involved.

How do you prove, even with a preponderance of the evidence, that person X was at the keyboard instead of person Y. Or it might have been Z out in the parking lot on an open access point. You can't prove it, so no prosecution is possible.

This is just another attack on the free software community as outlined in the Haloween Documents.

Actualy they only modified their own DNS server. This is not breaking the Ineternet. This is breaking Cox/Time Warner walled garden ISP DNS.

If you don't like the faulty DNS, feel free to change to one of the other public DNS servers such as the public Verison DNS Server at 4.2.2.1. You don't have to use your ISP's DNS server. Go into your router setup and switch from dynamic DNS to Static and plug in 2 or 3

Yes, but arguably DNS is a services you expect your ISP to provide. I know I do. I rather like my ISPs DNS server, its fast and near to me in terms of hops. Its a great forward DNS server for the DNS server on my personal network.I expect my ISP to provide me with correct DNS loopup results. If they don't then they would not be providing me with part of the service I understand I am paying them for. They would hear from me about it pretty quickly and more then likely loose my business over it. There ar

Remember how well that worked for email. If you don't want to use your ISPs SMPT server because you didn't like their policies you could just run your own. Now, many of them do their absolute damnedest to force you to use theirs by blocking access to others... all in the fight against spam.If the botnets/etc get wise to the fact that the ISPs are fucking with DNS, they'll just start dodging the ISPs DNS service, like the spambots dodged the ISPs smpt server.

only extends to where someone else's nose begins. If someone is harming your chattels, then you have the right to take appropriate action to limit the damage. I'd love to see a botnet operator sue Time Warner - "Judge it is not fair, they hit back first! Waaaaaahhhh..."

I have mod points, but I'd like to collectively reply to a few of the comments I see here. for those of you that are commending this act of vigilantism, stop and think - is this the most effective way to tackle the problem? The way I see it is that being a vigilante is akin to being involved in a constant game of whack-a-mole. The only problem is that when you start taking down bots (or even whole botnets), the people running them begin to realise that their current generation of malware isn't effective enough, and create something that is harder to detect. As the summary notes, we've already seen [slashdot.org] them trying to improve their resources. There was another post I saw on here that put it more eloquently, essentially saying: vigilantism only helps the bad guys work out where they need to improve.

So how about instead of trying to fight a brushfire with an extinguisher, we get to the root of the problem and start educating users. Yes, that takes effort. I can't begin to count the hours I've spent trying to explain to folk why using an alternative browser (or OS or whatever) is a good idea, and what they should look for in a reputable site, and so on and so on ad nauseum. It's a slow process, but the more people that are aware of the risks - and more importantly, the reasons for the risks - the less there potential 'marks' there are for all the script kiddeez, rooters and organised criminals out there.

And for us on/. - less requests to fix the family computer when we visit at Christmas.

Have you walked down your street, knocking on doors, offering to educate them? It doesn't work too well. I tried it as a 'break the ice' to help secure unsecured networks from my neighbors (live in a single family home neighborhood, not an apartment complex) right after we moved in. A lot of people looked at me odd, and only one wanted to know about it, out of the 7 homes I tried before quitting. I'd walk the culdesac with my iBook showing them how anyone could log on and just a simple WEP password wou

Actually, I haven't proffered my services like that, but I actually think it's a good idea. When I move into my next apartment (looking for a place at the moment) I think I'll give it a shot. As you say it may not have a great success rate but it is a good icebreaker.

I'd recommend other folk try this too - it can come in very handy to have a reputation as 'that helpful guy in the building / on the block'.

When I first read your post I thought you were trying to make a dry joke, but I figure from your other posts that you are serious. If you really want a dedicated police force for this sort of thing why not show local politicians that it is feasible, important, and not a waste of money (the last one is the most important). If you can give them an example ("Here is a guy I tracked down in 5 hours. He controls 10,000 bots he can do $50,000 worth of damage an hour. He has probably misappropriated 1000 identitie

This isn't the perfect or ideal way to do things. But its about damned time the ISPs did something.

There is simply **NO** excuse for a bot to be running on any ISP for more than the time it takes to detect it pumping out massive volumes of email. My solution, as I've stated several times, would be to disconnect the offending computer, and then fire them off a snailmail letter stating that they will not be permitted back until their computer is disinfected. But since that would cost them customers, no one will do that.

There is simply **NO** excuse for a bot to be running on any ISP for more than the time it takes to detect it pumping out massive volumes of email.

So, all they'd have to do is to watch egress traffic, and if somebody was sending mail to, say, more than 20 different e-mail servers in the course of an hour (perhaps with a ramp-up capability), then suspect they're a spammer and either a) get them on a whitelist if they're not, or b) prevent them from sending more mail unless it's properly relayed.

This might give us some brief reprieve, timewarner needed to do this to prevent their network getting banned in places, i already banned it from my mailservers. the botnetters will just use ip addresses next...

They can use IP addresses all they want. TW can easily just reroute where it goes on their network. Hijacking the DNS request is just a simple means of accomplishing this. Not to mention these people won't be able to hide so well if they actually use an IP address.

It's not vigilantism...TW has the right to protect their network, and what you do on it if it's harmful to it. They could just kick users off entirely. Trust me, they have no issue with it. They will actually terminate accounts if you get infected with a viri one too many times. I've had friends who it's happened to. When people won't listen theres only one way to fix a problem. Be a dick, and take care of business.

"Tortious interference," is part of english common law roughly defined as the causing of harm by disrupting something that belongs to someone else. The original example was a guy who repeatedly drove ducks away from his neighbors' pond by firing a gun in the air on his own property.

So no, its not legal. But if you want to pursue it in court, you have only one of the weaker common-law torts to rely on.

First, as a person who owns and operates many networks, I would be rather annoyed that someone has hijacked one of my domains, for any purpose.

To me, a domain name is the equivalent to a land deed, it's a peace of virtual real-estate. It's a representation and label identifying a group of IP addresses which may or may not be associated to a physical device or service. If I have a problem with some other network, I attempt to contact the powers-that-be of the offending network; in good faith, that they would be cooperative.

Now, I assume many offensive networks out there might not cooperate, or might think that what their network is doing is either legal, moral, or of no harm. Well... I do admit, I block all of APNIC to my mail servers, though, I do not service "customers" either. If I did, I would assume my customer demographic might include a need or desire for correspondence with those in APNIC, and permit the traffic. While I might, on case by case scenerios, filter a range of IPs known for SPAM or whatever, things I certainly wouldn't do is hi-jack a domain, and most disturbingly, attempt to execute code on a clients machine without direct consent for each instance, each time. Basically, what you're doing then is intentionally deceiving a computer system, breaking standards, breaking and entering said computer system, and influencing change which permanently alters HOW that computer operates. And, knowing the practices and the broad generalized sweeping tactics of Cox Communications (for example), I must say I do NOT trust what they MIGHT consider as "malicious" code to delete off my computer "at their whim".

If this becomes "legal", then what's to stop Cox Communications (for example), from considering my MP3s as "malicious or of questionable origin" and on behalf of RIAA, delete my mp3s? How are they going to know?

Now, on to San Diego Cox Communications. While I agree that if you are on someones network, you do what they say. However, as already implied above, if my intention is to provide "Internet Service", then I DO inherently forfeit some of that overall power. And Cox Cable, blocking incoming and outgoing ports is really not within their moral obligation to do so. Nothing illegal about them doing it, no doubt some here might agree with them. But, if I'm going to sell someone "Internet Service", as I have in the past, they get "Internet Service" in full. I don't want a parent above me, and most certainly, I should be allowed unaltered Internet Service from Cox Communications on request against the default safegaurds in-place for the sake of the laymen.

But, Cox Communications does NOT permit one to exercise all of the technologies available. They notoriously block ports, and muck with the traffic. Why? Who knows, and I don't mean to be elitist, but their explanations of some Windows worm really doesn't apply to my Linux box. Besides, if I was running Windows, I still wouldn't appreciate all the port blocking and crap. I'll handle that myself.

As a result, I refuse to use Cox Cable or Time Warners Road Runner services. (Aside from the fact I'm banned from San Diego Cox Cable's network for running VPN clouds on their network, among other things like DoS'ing everyone on my subnet to boost my download speeds...), I warmly welcome other high-speed services that do NOT play parenthood. Sadly, one practically has to purchase a "Business" line instead of a "Home" connection. So, that's in fact what I have so if I want to launch my own webserver/mailserver, SQL Server or whatever, it's simply a matter of just configuring and launching the daemon.

In short, I feel hi-jacking is wrong. And I feel that people should not use Cox Cable as they are the "AOL" of today anyways. Such actions are so typical of Cox Cable... it's truelly ridiculous.

Well as some have pointed out you can use other DNS servers. However, many people don't have the time/knowledge/or need to mess with this and they really shouldn't have to. Messing with DNS for these purposes is a questionable activity. However, especially in the case of EFNet servers, I find this especially strange. EFNet does have some botnets that end up with them, but they are very few and far between.. and small in nature. These things are taken down pretty rapidly on EFNet and that's part of the reason they're not used frequently. DALnet -- a whole other story. There's tons of active botnets there now. EFNet is definitely much smaller in scale n terms of the number, the size, and the lifespan. This is pretty sad. Redirecting a hacked server being used by an IRCD is one thing. Doing it selective IRCDs on a huge *legit* network.. that's a whole other story.

I find it ironic that Time Warner is going at this from the wrong end of the problem. If they filtered port 25 traffic from broadband DUL space, the spammers wouldn't be interested in invading their customers' machines. It's almost always about spam. The fact that most of these ISPs do little to stop their customers' machines from being zombied, or anything to reduce the viability of them being exploited, shows how much they really care about the customers. All broadband ISPs should now be filtering SMTP traffic on their networks. Anyone that wants to run their own mail server can set up alternate ports and use special IP space designated for SMTP traffic. This would make the botnets obsolete.

yeah, a bot isn't a irc server I get that. I was being general, but if you like you can add "black-listing sites that do not prevent themselves from being used in the command-control of a bot-net" to my list of things that are fine by me.

---AFT (About Fyucking Time) Defense/Offense Corporatist attack a real enemy of US. They (Corporations/associations/laws... RIAA, MPAA, DMCA...) have been using the law to spy on and attack citizens......Wow. That is one hell of a rant. Too bad it's just full of sticking points towards every group you hate. That adds nothing.

---If you want to win you must always be on the offense. Offense or Defense will always win a battle, but only offense can win the war.

You've probably seen something similar when you have to install an ActiveX control in IE (for a bank, or Windows Update). It asks i) if you'd like to install it and ii) If you'd like to trust the publisher in the future.

The binary is cryptographically signed which assures the computer that it is a product of the authorised holder of a particular crypto key. MS already uses this scheme for device drivers on 64-bit versions of Vista - at present, it can be disabled by a technically oriented user, but there's no guarantee that ability will persist.

The downside is twofold - firstly, for this measure to have any teeth, you have to remove the ability of the user to ignore it. Secondly, it provokes ideas like Microsofts "Trusted Computing" initiative (aka "Palladium"), which hands over full control of your computer to a short list of people who know the secret keys embedded in your motherboard. The main motivator for requiring signed drivers in Vista is to prevent the loading of things like virtual devices which can be used to capture perfect digital copies of DRM protected media. A secondary consideration is quality assurance.

At some point it is inevitable that MS operating systems will produce an API that permits calling programs to determine the presence of unsigned drivers or software, and refuse to perform certain functions (like playback of DRMed media). Heck, this shouldn't be hard to implement right now with a little effort. With TP, because the only trusted root certificates will be stored in inaccessible firmware, there will be no way for the user to sign drivers himself and mark them as trusted. Therefore MS (and anyone they care about pleasing) will be in control of what your computer can or cannot do.